[Code scan] Pin the Gitee mirror reusable workflow before passing secrets

[njzjz]

This issue was found during a Codex global code scan of the repository.

Baseline commit: e3c5b38

Problem

The mirror workflow passes SYNC_GITEE_PRIVATE_KEY to a reusable workflow referenced by the mutable main branch.

Code references:

dpgui/.github/workflows/mirror_gitee.yml

Lines 7 to 10 in e3c5b38

	git-mirror:
	uses: deepmodeling/workflows/.github/workflows/mirror_gitee.yml@main
	secrets:
	SYNC_GITEE_PRIVATE_KEY: ${{ secrets.SYNC_GITEE_PRIVATE_KEY }}

Relevant snippet:

uses: deepmodeling/workflows/.github/workflows/mirror_gitee.yml@main
secrets:
  SYNC_GITEE_PRIVATE_KEY: ${{ secrets.SYNC_GITEE_PRIVATE_KEY }}

Impact

Any future change to deepmodeling/workflows@main changes the code that receives this private key. That makes the secret-bearing workflow dependent on a mutable external ref.

Suggested fix

Pin the reusable workflow to an immutable commit SHA or a protected release tag, and keep the Gitee private key scoped to the minimum required permissions.